<!doctype html>
<html lang="en-US">

<head>
	<!-- Google Tag Manager -->
	<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
	new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
	j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
	'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
	})(window,document,'script','dataLayer','GTM-534FD7K');</script>
	<!-- End Google Tag Manager -->

    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
    <link rel="profile" href="https://gmpg.org/xfn/11">

    <title>Shades of Red: RedXOR Linux backdoor and its Chinese origins &#8211; VB2021 localhost</title>
<meta name='robots' content='max-image-preview:large' />
<link rel='dns-prefetch' href='//s.w.org' />
<script type="text/javascript">
window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.1.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/13.1.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/vblocalhost.com\/wp-includes\/js\/wp-emoji-release.min.js?ver=5.9.3"}};
/*! This file is auto-generated */
!function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){var a=String.fromCharCode;p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,e),0,0);e=i.toDataURL();return p.clearRect(0,0,i.width,i.height),p.fillText(a.apply(this,t),0,0),e===i.toDataURL()}function c(e){var t=a.createElement("script");t.src=e,t.defer=t.type="text/javascript",a.getElementsByTagName("head")[0].appendChild(t)}for(o=Array("flag","emoji"),t.supports={everything:!0,everythingExceptFlag:!0},r=0;r<o.length;r++)t.supports[o[r]]=function(e){if(!p||!p.fillText)return!1;switch(p.textBaseline="top",p.font="600 32px Arial",e){case"flag":return s([127987,65039,8205,9895,65039],[127987,65039,8203,9895,65039])?!1:!s([55356,56826,55356,56819],[55356,56826,8203,55356,56819])&&!s([55356,57332,56128,56423,56128,56418,56128,56421,56128,56430,56128,56423,56128,56447],[55356,57332,8203,56128,56423,8203,56128,56418,8203,56128,56421,8203,56128,56430,8203,56128,56423,8203,56128,56447]);case"emoji":return!s([10084,65039,8205,55357,56613],[10084,65039,8203,55357,56613])}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.flag,t.DOMReady=!1,t.readyCallback=function(){t.DOMReady=!0},t.supports.everything||(n=function(){t.readyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(n=t.source||{}).concatemoji?c(n.concatemoji):n.wpemoji&&n.twemoji&&(c(n.twemoji),c(n.wpemoji)))}(window,document,window._wpemojiSettings);
</script>
<style type="text/css">
img.wp-smiley,
img.emoji {
	display: inline !important;
	border: none !important;
	box-shadow: none !important;
	height: 1em !important;
	width: 1em !important;
	margin: 0 0.07em !important;
	vertical-align: -0.1em !important;
	background: none !important;
	padding: 0 !important;
}
</style>
	<link rel='stylesheet' id='wp-block-library-css'  href='https://vblocalhost.com/wp-includes/css/dist/block-library/style.min.css?ver=5.9.3' type='text/css' media='all' />
<style id='global-styles-inline-css' type='text/css'>
body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--duotone--dark-grayscale: url('#wp-duotone-dark-grayscale');--wp--preset--duotone--grayscale: url('#wp-duotone-grayscale');--wp--preset--duotone--purple-yellow: url('#wp-duotone-purple-yellow');--wp--preset--duotone--blue-red: url('#wp-duotone-blue-red');--wp--preset--duotone--midnight: url('#wp-duotone-midnight');--wp--preset--duotone--magenta-yellow: url('#wp-duotone-magenta-yellow');--wp--preset--duotone--purple-green: url('#wp-duotone-purple-green');--wp--preset--duotone--blue-orange: url('#wp-duotone-blue-orange');--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}
</style>
<link rel='stylesheet' id='font-awesome-css'  href='https://vblocalhost.com/wp-content/themes/frontend/assets/css/font-awesome.min.css?ver=4.7.0' type='text/css' media='all' />
<link rel='stylesheet' id='frontend-style-css'  href='https://vblocalhost.com/wp-content/themes/frontend/style.css?ver=1636016171' type='text/css' media='all' />
<link rel='stylesheet' id='slick-css'  href='https://vblocalhost.com/wp-content/themes/frontend/assets/css/slick.css?ver=5.9.3' type='text/css' media='all' />
<link rel='stylesheet' id='swipebox-css'  href='https://vblocalhost.com/wp-content/themes/frontend/blocks/gallery/swipebox/css/swipebox.min.css?ver=5.9.3' type='text/css' media='all' />
<script type='text/javascript' src='https://vblocalhost.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0' id='jquery-core-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2' id='jquery-migrate-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/assets/js/slick.min.js?ver=5.9.3' id='slick-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/assets/js/custom.js?ver=1632047916' id='custom-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/assets/js/blog-script.js?ver=1618907319' id='blog-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/assets/js/presentation-filter.js?ver=1631894528' id='presentation-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/inc/libraries/countdown/countdown.min.js?ver=1618907319' id='coundown-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/blocks/navigation/custom.js?ver=1632047916' id='navigaion-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/blocks/accordions/custom.js?ver=5.9.3' id='accordion-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/blocks/slider/script.js?ver=5.9.3' id='frontend-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/blocks/testimonials/script.js?ver=5.9.3' id='testimonials_frontend-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/blocks/gallery/swipebox/js/jquery.swipebox.js?ver=5.9.3' id='swipebox-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/blocks/gallery/script.js?ver=5.9.3' id='gallery-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/inc/libraries/cookie-consent/cookieconsent.min.js?ver=1618907319' id='cookie-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/blocks/cookie-popup/script.js?ver=1618907319' id='cookie-popup-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/blocks/header/script.js?ver=1618907319' id='header-script-js'></script>
<script type='text/javascript' src='https://vblocalhost.com/wp-content/themes/frontend/blocks/posts/script.js?ver=5.9.3' id='posts_frontend-js'></script>
<link rel="https://api.w.org/" href="https://vblocalhost.com/wp-json/" /><link rel="alternate" type="application/json" href="https://vblocalhost.com/wp-json/wp/v2/presentations/304" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://vblocalhost.com/xmlrpc.php?rsd" />
<link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://vblocalhost.com/wp-includes/wlwmanifest.xml" /> 
<meta name="generator" content="WordPress 5.9.3" />
<link rel="canonical" href="https://vblocalhost.com/presentations/shades-of-red-redxor-linux-backdoor-and-its-chinese-origins/" />
<link rel='shortlink' href='https://vblocalhost.com/?p=304' />
<link rel="alternate" type="application/json+oembed" href="https://vblocalhost.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvblocalhost.com%2Fpresentations%2Fshades-of-red-redxor-linux-backdoor-and-its-chinese-origins%2F" />
<link rel="alternate" type="text/xml+oembed" href="https://vblocalhost.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fvblocalhost.com%2Fpresentations%2Fshades-of-red-redxor-linux-backdoor-and-its-chinese-origins%2F&#038;format=xml" />
<link rel="icon" href="https://vblocalhost.com/uploads/2021/04/cropped-cropped-ms-icon-310x310-1-32x32.png" sizes="32x32" />
<link rel="icon" href="https://vblocalhost.com/uploads/2021/04/cropped-cropped-ms-icon-310x310-1-192x192.png" sizes="192x192" />
<link rel="apple-touch-icon" href="https://vblocalhost.com/uploads/2021/04/cropped-cropped-ms-icon-310x310-1-180x180.png" />
<meta name="msapplication-TileImage" content="https://vblocalhost.com/uploads/2021/04/cropped-cropped-ms-icon-310x310-1-270x270.png" />
		<style type="text/css" id="wp-custom-css">
			.conference-workshops__card__how a {
	font-size: 100%
}		</style>
		</head>

<body class="presentations-template-default single single-presentations postid-304">
	<!-- Google Tag Manager (noscript) -->
	<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-534FD7K"
	height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
	<!-- End Google Tag Manager (noscript) -->
	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-dark-grayscale"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0 0.49803921568627" /><feFuncG type="table" tableValues="0 0.49803921568627" /><feFuncB type="table" tableValues="0 0.49803921568627" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-grayscale"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0 1" /><feFuncG type="table" tableValues="0 1" /><feFuncB type="table" tableValues="0 1" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-purple-yellow"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.54901960784314 0.98823529411765" /><feFuncG type="table" tableValues="0 1" /><feFuncB type="table" tableValues="0.71764705882353 0.25490196078431" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-blue-red"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0 1" /><feFuncG type="table" tableValues="0 0.27843137254902" /><feFuncB type="table" tableValues="0.5921568627451 0.27843137254902" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-midnight"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0 0" /><feFuncG type="table" tableValues="0 0.64705882352941" /><feFuncB type="table" tableValues="0 1" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-magenta-yellow"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.78039215686275 1" /><feFuncG type="table" tableValues="0 0.94901960784314" /><feFuncB type="table" tableValues="0.35294117647059 0.47058823529412" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-purple-green"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.65098039215686 0.40392156862745" /><feFuncG type="table" tableValues="0 1" /><feFuncB type="table" tableValues="0.44705882352941 0.4" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 0 0" width="0" height="0" focusable="false" role="none" style="visibility: hidden; position: absolute; left: -9999px; overflow: hidden;" ><defs><filter id="wp-duotone-blue-orange"><feColorMatrix color-interpolation-filters="sRGB" type="matrix" values=" .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 .299 .587 .114 0 0 " /><feComponentTransfer color-interpolation-filters="sRGB" ><feFuncR type="table" tableValues="0.098039215686275 1" /><feFuncG type="table" tableValues="0 0.66274509803922" /><feFuncB type="table" tableValues="0.84705882352941 0.41960784313725" /><feFuncA type="table" tableValues="1 1" /></feComponentTransfer><feComposite in2="SourceGraphic" operator="in" /></filter></defs></svg>	
<div class="conference">
<header class="block-navigation">
		<div class="block-navigation__wrapper d-flex justify-content-between align-items-center">

			<div class="block-navigation__left__header h-pl--100 h-bgcolor--sidebar-gray">
				<div class="block-navigation__left__inner d-flex align-items-center">
					<a href="/conference"><img src="https://vblocalhost.com/wp-content/themes/frontend/assets/images/logo.svg" class="block-navigation__left__header__logo" alt="Shades of Red: RedXOR Linux backdoor and its Chinese origins"></a>
				</div>
			</div>

			<div class="block-navigation__right__header d-flex align-items-center h-mr--100">
									<h6 class="h-m--0 h-pl--40">Presentation information</h6>
													<p class="h-fs--14 block-navigation__right__header-text h-fw--700 h-p--20 h-m--0 psa">Welcome to the VB2021 conference!</p>
							</div>

			<div class="block-navigation__hamburger-box">
				<div class="block-navigation__hamburger-inner">
				</div>
			</div>

			<div class="block-navigation__handheld-menu-wrapper animation">
				<div class="container">
					<div class="block-navigation__handheld-menu">
							<a href="https://vblocalhost.com"><img src="https://vblocalhost.com/wp-content/themes/frontend/assets/images/logo-white.svg" class="block-navigation__left__header__logo" alt="Shades of Red: RedXOR Linux backdoor and its Chinese origins"></a>
						<div class="conference__sidebar h-mb--30 h-ml--100">
							<ul>
							
																
										<li ><a href="https://vblocalhost.com/conference/" class="animate-underline d-flex">
										

									<img src="https://vblocalhost.com/uploads/2021/08/homebull3.svg" class="menu-icon h-mr--10 h-mt--5" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/homebull.svg" class="menu-icon-hover h-mr--10 h-mt--5" alt="" loading="lazy" />											Home										</a>
									</li>
																	
										<li ><a href="https://vblocalhost.com/conference/day-1/" class="animate-underline d-flex">
										

									<img src="https://vblocalhost.com/uploads/2021/08/live-handheld.svg" class="menu-icon h-mr--10 h-mt--5" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/live-hover2.svg" class="menu-icon-hover h-mr--10 h-mt--5" alt="" loading="lazy" />											Watch live										</a>
									</li>
																	
										<li ><a href="https://vblocalhost.com/conference/presentation-library/" class="animate-underline d-flex">
										

									<img src="https://vblocalhost.com/uploads/2021/08/library-handheld.svg" class="menu-icon h-mr--10 h-mt--5" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/library-hover.svg" class="menu-icon-hover h-mr--10 h-mt--5" alt="" loading="lazy" />											Watch on demand										</a>
									</li>
																	
										<li ><a href="https://vblocalhost.com/conference/workshops/" class="animate-underline d-flex">
										

									<img width="413" height="297" src="https://vblocalhost.com/uploads/2021/09/book-1-1.png" class="menu-icon h-mr--10 h-mt--5" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/09/book-1-1.png 413w, https://vblocalhost.com/uploads/2021/09/book-1-1-300x216.png 300w" sizes="(max-width: 413px) 100vw, 413px" /><img width="413" height="297" src="https://vblocalhost.com/uploads/2021/09/book-1.png" class="menu-icon-hover h-mr--10 h-mt--5" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/09/book-1.png 413w, https://vblocalhost.com/uploads/2021/09/book-1-300x216.png 300w" sizes="(max-width: 413px) 100vw, 413px" />											Take a workshop										</a>
									</li>
																	
										<li ><a href="https://vblocalhost.com/conference/engage/" class="animate-underline d-flex">
										

									<img src="https://vblocalhost.com/uploads/2021/08/discord-handheld.svg" class="menu-icon h-mr--10 h-mt--5" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/discord-hover.svg" class="menu-icon-hover h-mr--10 h-mt--5" alt="" loading="lazy" />											Chat										</a>
									</li>
																	
										<li ><a href="https://vblocalhost.com/conference/contact-us/" class="animate-underline d-flex">
										

									<img src="https://vblocalhost.com/uploads/2021/08/contact-handheld.svg" class="menu-icon h-mr--10 h-mt--5" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/contact-hover.svg" class="menu-icon-hover h-mr--10 h-mt--5" alt="" loading="lazy" />											Contact us										</a>
									</li>
									
									<li >
										<a href="https://vb2020.vblocalhost.com/" target="_blank" class="animate-underline d-flex">
											<img src="https://vblocalhost.com/wp-content/themes/frontend/assets/icons/vb-icon-small-white.svg" class="menu-icon h-mr--10" alt="" loading="lazy">
											<img src="https://vblocalhost.com/wp-content/themes/frontend/assets/icons/vb-icon-small-white.svg" class="menu-icon-hover h-mr--10" alt="" loading="lazy">
											VB2020
										</a>
									</li>

															</ul>
						</div>

						<div>
																					<div class="row conference__sidebar__dynamic-content">

																	
																			<a href="https://vblocalhost.com/conference/cyber-threat-alliance/" class="animate-underline h-mb--20">
																				<img width="128" height="128" src="https://vblocalhost.com/uploads/2021/08/cta-logo-128x128-8bit-alpha.png" class="conference__sidebar__partner-logo" alt="" loading="lazy" />																							CTA TIPS																					</a>
																	
								</div>
															<div class="row conference__sidebar__dynamic-content">

																	
																			<a href="https://vblocalhost.com/conference/qianxin/" class="animate-underline h-mb--20">
																				<img width="122" height="53" src="https://vblocalhost.com/uploads/312c07c5-3ed2-40ce-b29d-4adb0ff0bf25.jpeg" class="conference__sidebar__partner-logo" alt="" loading="lazy" />																							QI-ANXIN																					</a>
																	
								</div>
																			</div>
					</div>
				</div>
			</div>

		</div>

	</header>
			<p class="h-fs--14 block-navigation__right__header-text--mobile h-fw--700 h-p--20 h-m--0 psa" >Welcome to the VB2021 conference!</p>
	</div>
<div class="teaser">
<header class="block-navigation">
	<div class="container">
		<div class="block-navigation__wrapper d-flex justify-content-between align-items-center">
			<a href="https://vblocalhost.com">
				<div class="block-navigation__logo-wrapper">
					<img src="https://vblocalhost.com/wp-content/themes/frontend/assets/images/logo-white.svg?ver=1" class="block-navigation__logo--white" alt="Shades of Red: RedXOR Linux backdoor and its Chinese origins">
					<img src="https://vblocalhost.com/wp-content/themes/frontend/assets/images/logo.svg?ver=1" class="block-navigation__logo" alt="Shades of Red: RedXOR Linux backdoor and its Chinese origins">
				</div>
			</a>

			<ul id="primary-menu" class="block-navigation__desktop-menu"><li id="menu-item-368" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-368"><a href="https://vblocalhost.com/registration/">Register</a></li>
<li id="menu-item-340" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-340"><a href="https://www.virusbulletin.com/conference/vb2021/partners/">Partners</a></li>
<li id="menu-item-99" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-99"><a href="https://vblocalhost.com/programme/">Programme</a></li>
<li id="menu-item-337" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-337"><a href="https://vb2020.vblocalhost.com/conference/">View VB2020</a></li>
</ul>
			<ul id="menu-primary-menu" class="block-navigation__handheld-menu"><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-368"><a href="https://vblocalhost.com/registration/">Register</a></li>
<li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-340"><a href="https://www.virusbulletin.com/conference/vb2021/partners/">Partners</a></li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-99"><a href="https://vblocalhost.com/programme/">Programme</a></li>
<li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-337"><a href="https://vb2020.vblocalhost.com/conference/">View VB2020</a></li>
</ul>
			
			<div class="block-navigation__hamburger-box">
				<div class="block-navigation__hamburger-inner">
				</div>
			</div>
		</div>

	</div>
</header>
</div>
<div id="top"></div>



<div class="conference presentation">
	<div class="page-content single-presentation h-mt--120 h-mt--md--60 h-max-width--110">

		<h2 class="single-presentation__title h-fs--lg--24 h-fs--28 h-pr--200 h-pr--lg--15 h-hw--700 h-mb--20 h-color--black">
			Shades of Red: RedXOR Linux backdoor and its Chinese origins		</h2>

					<div class="single-presentation__author h-fs--16 h-fw--500 h-color--black h-mb--40">Avigayil Mechtinger (Intezer) & Joakim Kennedy (Intezer)</div>
		
				<div class="single-presentation__thumbnail-wrapper">
			
			
					</div>

			

									<div class="single-presentation__video-section" style="border: 1px solid #e0e0e0">
												<div class="video__wrapper">
						<iframe frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen class="single-presentation__iframe h-bgcolor--black" width='100%' height='100%' src="https://www.youtube.com/embed/-IjoYS49eE0"></iframe>
					</div>
								</div>
		
									<div class="h-mb--40">
						<div class="ad-rotator ad-rotator__wrapper h-mb--30 h-mt--25">

									<div id="sponored-text-80" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">Farsight Security DNSDB® is the world's largest real-time and historical database of DNS resolutions</h2>
						
																					<a class="single-message__link" href="https://www.farsightsecurity.com/get-started-guide/" target="_blank">https://www.farsightsecurity.com/get-started-guide/</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">DNSDB 2.0 introduces Flexible Search support, unlocking both Regular Expressions and Globbing syntaxes for more granular and accurate search results. Get your free DNSDB API key and use it in our newly updated</p>
						
													<p class="single-message__line h-mb--0">web GUI, DNSDB Scout as well as your own existing environments. Contextualize everything that is DNS related with one API key - DNSDB.</p>
						
											</div>
				</div>
									<div id="sponored-text-90" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">QI-ANXIN Technology Group Inc. Leader of New Generation Cybersecurity</h2>
						
																					<a class="single-message__link" href="https://ti.qianxin.com/marketing/vb2021/" target="_blank">https://ti.qianxin.com/marketing/vb2021/</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">QI-ANXIN Technology Group Inc. offers next generation enterprise-class cybersecurity products </p>
						
													<p class="single-message__line h-mb--0">and services to government and businesses. QI-ANXIN is the Official Cyber Security Services and </p>
						
													<p class="single-message__line h-mb--0">Anti-Virus Software Sponsor of the Olympic and Paralympic Winter Games Beijing 2022.</p>
											</div>
				</div>
									<div id="sponored-text-30" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">IoT security begins with your Smart TV</h2>
						
																					<a class="single-message__link" href="https://chomar.link/smarttv" target="_blank">https://chomar.link/smarttv</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">CHOMAR Smart TV Security.</p>
						
													<p class="single-message__line h-mb--0">Protect your Android Smart TV against malicious activities and use your IoT devices without any worries.</p>
						
											</div>
				</div>
									<div id="sponored-text-120" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">Calling all Hackers!</h2>
						
																					<a class="single-message__link" href="https://www.ise.io/careers/#op-470256-hacker-midseniorprincipal" target="_blank">https://www.ise.io/careers/#op-470256-hacker-midseniorprincipal</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">We are hiring mid-senior-principal level hackers! </p>
						
													<p class="single-message__line h-mb--0">Remote option • Flex schedule • Unlimited vacation • Opportunities for research and publication</p>
						
											</div>
				</div>
									<div id="sponored-text-100" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">Do you like doing work that matters to you… and really frustrates the bad guys?</h2>
						
																					<a class="single-message__link" href="https://talosintelligence.com/careers" target="_blank">https://talosintelligence.com/careers</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">At Talos, our mission is to make the internet a safer place and fight the good fight for our customers </p>
						
													<p class="single-message__line h-mb--0">and users. If you think you have the expertise and attitude to help lead  the world in cutting-edge security, </p>
						
													<p class="single-message__line h-mb--0">we’d like to talk.</p>
											</div>
				</div>
									<div id="sponored-text-20" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">Amazon Information Security - come build the future with us!</h2>
						
																					<a class="single-message__link" href="https://www.amazon.jobs/en-gb/team/infosec" target="_blank">https://www.amazon.jobs/en-gb/team/infosec</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">Do you want to work on privacy and security challenges at unprecedented scale?</p>
						
													<p class="single-message__line h-mb--0">We have Privacy and Information Security opportunities available now across</p>
						
													<p class="single-message__line h-mb--0">the United States, Dublin, Ireland, and Sydney, Australia.</p>
											</div>
				</div>
									<div id="sponored-text-70" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">Ransomware prevention starts with zero</h2>
						
																					<a class="single-message__link" href="https://www.zscaler.com/solutions/security-transformation/ransomware-protection" target="_blank">https://www.zscaler.com/solutions/security-transformation/ransomware-protection</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">Ransomware attacks are increasing 500% year-over-year.</p>
						
													<p class="single-message__line h-mb--0">Learn how Zscaler's Zero Trust Exchange helps minimize exposure, damage, and risk </p>
						
													<p class="single-message__line h-mb--0">at every stage of a ransomware attack.</p>
											</div>
				</div>
									<div id="sponored-text-60" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">Stay ahead of threats with VirusTotal</h2>
						
																					<a class="single-message__link" href="https://www.virustotal.com/" target="_blank">https://www.virustotal.com/</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">Stay ahead of the next generation of threats and get relevant insights to solve </p>
						
													<p class="single-message__line h-mb--0">the most critical security challenges.</p>
						
											</div>
				</div>
									<div id="sponored-text-50" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">We don’t just talk about sharing. We do it every day.</h2>
						
																					<a class="single-message__link" href="https://www.cyberthreatalliance.org/about-cta" target="_blank">https://www.cyberthreatalliance.org/about-cta</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">Learn how to collaborate with the Cyber Threat Alliance to improve your overall cyber resilience.</p>
						
													<p class="single-message__line h-mb--0">We are a greater team when we work together; our collective efforts magnifies our success and</p>
						
													<p class="single-message__line h-mb--0">ensures that we are and remain cyber resilient.</p>
											</div>
				</div>
									<div id="sponored-text-130" class="single-message blue-theme h-color--white h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--secondary">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">Looking for performance validation for your product?</h2>
						
																					<a class="single-message__link" href="https://www.virusbulletin.com/testing/" target="_blank">https://www.virusbulletin.com/testing/</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">Get an edge over your competitors with Virus Bulletin’s anti-malware & email security certification </p>
						
													<p class="single-message__line h-mb--0">programmes, supported by 30+ years of experience. Or take advantage of our bespoke testing service </p>
						
													<p class="single-message__line h-mb--0">offering valuable performance feedback for R&D. Email <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="d0a4b5a3a490a6b9a2a5a3b2a5bcbcb5a4b9befeb3bfbdfe">[email&#160;protected]</a></p>
											</div>
				</div>
									<div id="sponored-text-40" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">F5 helps find malware hiding in plain sight</h2>
						
																					<a class="single-message__link" href="https://www.f5.com/company/blog/half-the-world-s-malware-is-now-encrypted" target="_blank">https://www.f5.com/company/blog/half-the-world-s-malware-is-now-encrypted</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">Encrypted malware is becoming increasingly common, and daisy-chaining security devices is neither </p>
						
													<p class="single-message__line h-mb--0">cost-effective, nor efficient. Detecting and stopping malware doesn’t have to be overwhelming with</p>
						
													<p class="single-message__line h-mb--0">F5’s innovative products.</p>
											</div>
				</div>
									<div id="sponored-text-110" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">VirusTotal: Actionable crowdsourced threat intelligence</h2>
						
																					<a class="single-message__link" href="https://www.virustotal.com/" target="_blank">https://www.virustotal.com/</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">Comprehensive context and cutting-edge functionality to proactively protect from cybersecurity threats.</p>
						
						
											</div>
				</div>
									<div id="sponored-text-10" class="single-message gray-theme h-px--20 h-pt--20 h-pb--20 justify-content-center flex-column h-bgcolor--light-gray">
			
					<span class="partner-message h-color--gray">
						partner message
					</span>

					<div class="single-message__content">
													<h2 class="single-message__title h-fs--20 h-mb--0">Threat Intelligence and Cyber Resilience</h2>
						
																					<a class="single-message__link" href="https://vblocalhost.com/programme/#TIPS" target="_blank">https://vblocalhost.com/programme/#TIPS</a>
													
													<p class="single-message__line h-mt--15 h-mb--0">Join the VB2021 Threat Intelligence Practitioners' Summit (TIPS), sponsored by the Cyber Threat Alliance,</p>
						
													<p class="single-message__line h-mb--0">and learn how investment in threat intelligence builds cyber resilience, allowing you to be more effective</p>
						
													<p class="single-message__line h-mb--0">when addressing today's dynamic threat landscape.</p>
											</div>
				</div>
			</div>

<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script><script>
	jQuery(function ($) {
		const s = '20000';
	// Init slick slider
	$('.ad-rotator__wrapper').slick({
		slidesToShow: 1,
		slidesToScroll: 1,
		arrows: false,
		dots: false,
		autoplay: true,
		autoplaySpeed: s,
	});

});

</script>
				</div>
					
					<div class="download-document">
    <div class="h-mb--30">

        <h2 class="download-document__title h-fs--20 h-mt--30">Downloads</h2>

        
            <ul>

                
                    <li class="download-document__inner h-py--5">

                                                    <a download href="https://vblocalhost.com/uploads/VB2021-Mechtinger-Kennedy.pdf" class="download-document__inner__link h-color--secondary h-fs--16">Download paper (PDF)</a>
                        
                    </li>

                
            </ul>


        
    </div>
</div>
		
		<div class="single-presentation__meta h-p--lg--15 h-mt--50">
							<div class="single-presentation__text h-fs--16 h-fw--500 h-color--black h-mb--50">2020 set a record for new Linux malware families. New malware targeting Linux systems are being discovered on a regular basis. Backdoors attributed to advanced threat actors are disclosed less frequently.<br />
<br />
In this talk, we will share a technical analysis of a newly uncovered backdoor we named RedXOR and explain why it is likely attributed to the Winnti umbrella. We will also touch upon the Linux threat landscape and how Linux malware find their way to compromised servers.<br />
<br />
As well as understanding RedXOR malware, which is among the most sophisticated Linux malware discovered in the past year, attendees of this talk will gain knowledge about Winnti Linux TTPs and ELF malware analysis. </div>
					</div>

		<div class="single-presentation__content">
				
		
		
					<div class="block-team-cards">
	<div class="block-team-cards__holder h-my--50 h-mb--md--50">

		
			
				<div class="block-team-cards__inner row justify-content-start h-mb--50">
				<div class="block-team-cards__image-holder h-pl--15">
					<img width="1024" height="768" src="https://vblocalhost.com/uploads/2021/05/Avigayil-Mechtinger-resize-1024x768.png" class="block-team-cards__image h-mr--15 h-mx--md--15" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/05/Avigayil-Mechtinger-resize-1024x768.png 1024w, https://vblocalhost.com/uploads/2021/05/Avigayil-Mechtinger-resize-300x225.png 300w, https://vblocalhost.com/uploads/2021/05/Avigayil-Mechtinger-resize-768x576.png 768w, https://vblocalhost.com/uploads/2021/05/Avigayil-Mechtinger-resize.png 1400w" sizes="(max-width: 1024px) 100vw, 1024px" />				</div>

					<div class="col-xl-9 col-md-7 block-team-cards__wrapper">
													<h6 class="h-fs--20 h-fw-700 h-mb--0 h-mt--md--15 h-color--secondary">Avigayil Mechtinger</h6>
						
													<span class="h-fs--16 h-fw-700 h-mb--20 h-color--secondary d-block">Intezer</span>
						
													<p class="block-team-cards__description h-fs--16 h-fw--500 h-color--black">Avigayil is a security researcher at Intezer specializing in malware analysis and threat hunting. During her time at Intezer, she has uncovered and documented different malware targeting both Linux and Windows platforms. As part of her ongoing work she has initiated the ELF Malware Analysis 101 series, to make ELF analysis approachable for beginners. Prior to joining Intezer, Avigayil was a cyber analyst in Check Point's mobile threat detection group.</p>
						
						<div class="block-team-cards__wrapper__social-icons d-flex flex-wrap h-mt--10">
															<a href="https://twitter.com/AbbyMCH" target="_blank" rel="noopener" class="block-team-cards__wrapper__social-icons__item h-mt--10 h-mr--15 h-color--secondary d-flex align-items-center">
									<i class="block-team-cards__wrapper__social-icons__item__icon h-fs--16 h-mr--5 d-flex align-items-center justify-content-center fa fa-twitter"></i>

									<span class="h-color--black h-fs--16">
																					@AbbyMCH																			</span>
								</a>
							
							
							
							
							
													</div>
					</div>
				</div>

			
				<div class="block-team-cards__inner row justify-content-start h-mb--50">
				<div class="block-team-cards__image-holder h-pl--15">
					<img width="899" height="1024" src="https://vblocalhost.com/uploads/2021/05/Joakim-Kennedy-resize-899x1024.png" class="block-team-cards__image h-mr--15 h-mx--md--15" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/05/Joakim-Kennedy-resize-899x1024.png 899w, https://vblocalhost.com/uploads/2021/05/Joakim-Kennedy-resize-263x300.png 263w, https://vblocalhost.com/uploads/2021/05/Joakim-Kennedy-resize-768x875.png 768w, https://vblocalhost.com/uploads/2021/05/Joakim-Kennedy-resize.png 1340w" sizes="(max-width: 899px) 100vw, 899px" />				</div>

					<div class="col-xl-9 col-md-7 block-team-cards__wrapper">
													<h6 class="h-fs--20 h-fw-700 h-mb--0 h-mt--md--15 h-color--secondary">Joakim Kennedy</h6>
						
													<span class="h-fs--16 h-fw-700 h-mb--20 h-color--secondary d-block">Intezer</span>
						
													<p class="block-team-cards__description h-fs--16 h-fw--500 h-color--black">Dr Joakim Kennedy is a security researcher for Intezer. On a daily basis he analyses malware, tracks threat actors, and solves security problems. His work is mainly focused on threats that target Linux systems and cloud environments. Dr Kennedy began in the industry as a security researcher at Rapid7, where he got his start in vulnerabilities research. Following his time with Rapid7, he joined Anomali. Whilst there, he managed Anomali's Threat Research Team, where they focused on creating threat intelligence. Dr Kennedy has been a featured speaker at multiple BSides events and at the CCB's Quarterly Cyber Threat Report Event. He has also presented at various other industry events.

For the last few years, Dr Kennedy has been researching malware written in Go. To make the analysis easier he has written the Go Reverse Engineering Toolkit (github.com/goretk), an open-source toolkit for analysis of Go binaries.</p>
						
						<div class="block-team-cards__wrapper__social-icons d-flex flex-wrap h-mt--10">
															<a href="https://twitter.com/joakimkennedy" target="_blank" rel="noopener" class="block-team-cards__wrapper__social-icons__item h-mt--10 h-mr--15 h-color--secondary d-flex align-items-center">
									<i class="block-team-cards__wrapper__social-icons__item__icon h-fs--16 h-mr--5 d-flex align-items-center justify-content-center fa fa-twitter"></i>

									<span class="h-color--black h-fs--16">
																					@joakimkennedy																			</span>
								</a>
							
							
							
							
							
													</div>
					</div>
				</div>

			
		
	</div>
</div>
		
		
         
		
         
        
         
		
		
		
		
		
		
		
		
		
		
		
		
		
		
			</div>
	</div>
	

<aside class="widget-area h-bgcolor--sidebar-gray">
	<div class="conference__sidebar h-mb--30 h-ml--100">
		<ul>

			
								
						<li ><a href="https://vblocalhost.com/conference/" class="animate-underline d-flex">
						


					<img src="https://vblocalhost.com/uploads/2021/08/homebull2.svg" class="menu-icon h-mr--10" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/homebull.svg" class="menu-icon-hover h-mr--10" alt="" loading="lazy" />							Home						</a>
					</li>
									
						<li ><a href="https://vblocalhost.com/conference/day-1/" class="animate-underline d-flex">
						


					<img src="https://vblocalhost.com/uploads/2021/08/live-icon1.svg" class="menu-icon h-mr--10" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/live-hover2.svg" class="menu-icon-hover h-mr--10" alt="" loading="lazy" />							Watch live						</a>
					</li>
									
						<li ><a href="https://vblocalhost.com/conference/presentation-library/" class="animate-underline d-flex">
						


					<img src="https://vblocalhost.com/uploads/2021/08/library-icon.svg" class="menu-icon h-mr--10" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/library-hover.svg" class="menu-icon-hover h-mr--10" alt="" loading="lazy" />							Watch on demand						</a>
					</li>
									
						<li ><a href="https://vblocalhost.com/conference/workshops/" class="animate-underline d-flex">
						


					<img width="512" height="512" src="https://vblocalhost.com/uploads/2021/09/book.png" class="menu-icon h-mr--10" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/09/book.png 512w, https://vblocalhost.com/uploads/2021/09/book-300x300.png 300w, https://vblocalhost.com/uploads/2021/09/book-150x150.png 150w" sizes="(max-width: 512px) 100vw, 512px" /><img width="413" height="297" src="https://vblocalhost.com/uploads/2021/09/book-1.png" class="menu-icon-hover h-mr--10" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/09/book-1.png 413w, https://vblocalhost.com/uploads/2021/09/book-1-300x216.png 300w" sizes="(max-width: 413px) 100vw, 413px" />							Take a workshop						</a>
					</li>
									
						<li ><a href="https://vblocalhost.com/conference/engage/" class="animate-underline d-flex">
						


					<img src="https://vblocalhost.com/uploads/2021/08/discord-icon.svg" class="menu-icon h-mr--10" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/discord-hover.svg" class="menu-icon-hover h-mr--10" alt="" loading="lazy" />							Chat						</a>
					</li>
									
						<li ><a href="https://vblocalhost.com/conference/contact-us/" class="animate-underline d-flex">
						


					<img src="https://vblocalhost.com/uploads/2021/08/contact-icon.svg" class="menu-icon h-mr--10" alt="" loading="lazy" /><img src="https://vblocalhost.com/uploads/2021/08/contact-hover.svg" class="menu-icon-hover h-mr--10" alt="" loading="lazy" />							Contact us						</a>
					</li>
					
					<li >
						<a href="https://vb2020.vblocalhost.com/" target="_blank" class="animate-underline d-flex">
							<img src="https://vblocalhost.com/wp-content/themes/frontend/assets/icons/vb-icon-small.png" class="menu-icon h-mr--10" alt="" loading="lazy">
							<img src="https://vblocalhost.com/wp-content/themes/frontend/assets/icons/vb-icon-small.png" class="menu-icon-hover h-mr--10" alt="" loading="lazy">
							VB2020
						</a>
					</li>


				

			</ul>
		</div>

		<div>
												<div class="row conference__sidebar__dynamic-content">

																	
													<a href="https://vblocalhost.com/conference/cyber-threat-alliance/" class="animate-underline h-mb--20">
														<img width="128" height="128" src="https://vblocalhost.com/uploads/2021/08/cta-logo-128x128-8bit-alpha.png" class="conference__sidebar__partner-logo" alt="" loading="lazy" />																	CTA TIPS															</a>
											
					</div>
									<div class="row conference__sidebar__dynamic-content">

																	
													<a href="https://vblocalhost.com/conference/qianxin/" class="animate-underline h-mb--20">
														<img width="122" height="53" src="https://vblocalhost.com/uploads/312c07c5-3ed2-40ce-b29d-4adb0ff0bf25.jpeg" class="conference__sidebar__partner-logo" alt="" loading="lazy" />																	QI-ANXIN															</a>
											
					</div>
									</div>

</aside><!-- #secondary -->
</div>

    
<footer>

	<div class="conference">
	<div class="d-flex">
		<div class="footer-spacing-left"></div>
		<div class="block-footer conference">
			<div class="block-footer__inner">
						<div class="block-footer__blocks-wrapper d-flex justify-content-between h-py--15  h-pb--md--0 h-mb--md--25">
													

						<div class="block-footer__general-information">
	<div class="block-footer__img-holder d-flex justify-content-between align-items-center">
		<img src="https://vblocalhost.com/wp-content/themes/frontend/assets/images/logo.svg" class="block-footer__general-information__logo footer-conference-logo" alt="Shades of Red: RedXOR Linux backdoor and its Chinese origins">

		<img width="1820" height="600" src="https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed.png" class="block-footer__general-information__logo" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed.png 1820w, https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed-300x99.png 300w, https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed-1024x338.png 1024w, https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed-768x253.png 768w, https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed-1536x506.png 1536w" sizes="(max-width: 1820px) 100vw, 1820px" />
					<div class="block-footer__general-information__footer-description h-color--graphite-black">
				<p><a href="https://twitter.com/hashtag/vblocalhost" target="_blank" rel="noopener">#vblocalhost</a></p>
			</div>

		
		
		
	</div>

</div>

															
																								
					
						<div class="block-social-icons">

  <div class="container">

    <div class="d-flex flex-wrap">

      
      
        
          
            <a href="https://twitter.com/virusbtn" class="d-flex justify-content-center align-items-center block-social-icons__item block-social-icons__item--rounded block-social-icons__item--small" target="_blank" rel="noopener"><i class="block-social-icons__item__logo h-color--white fa fa-twitter text-center"></i></a>

          
        
          
            <a href="https://www.linkedin.com/company/virus-bulletin" class="d-flex justify-content-center align-items-center block-social-icons__item block-social-icons__item--rounded block-social-icons__item--small" target="_blank" rel="noopener"><i class="block-social-icons__item__logo h-color--white fa fa-linkedin text-center"></i></a>

          
        
          
            <a href="https://www.facebook.com/virusbulletin" class="d-flex justify-content-center align-items-center block-social-icons__item block-social-icons__item--rounded block-social-icons__item--small" target="_blank" rel="noopener"><i class="block-social-icons__item__logo h-color--white fa fa-facebook-f text-center"></i></a>

          
        
          
            <a href="https://www.youtube.com/user/virusbtn" class="d-flex justify-content-center align-items-center block-social-icons__item block-social-icons__item--rounded block-social-icons__item--small" target="_blank" rel="noopener"><i class="block-social-icons__item__logo h-color--white fa fa-youtube-play text-center"></i></a>

          
        
      
    </div>

  </div>
</div>

												</div>
			
			<div class="block-footer__middle h-pt--10">

				
					
						<div class="block-footer__logos">

    
        <div class="container">

            
                <div class="block-logos__inner d-flex flex-row justify-content-center align-items-center flex-wrap">

                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.chomar.com.tr" target="_blank" rel="noopener">
                                        <img width="448" height="143" src="https://vblocalhost.com/uploads/2021/06/chomar-2-143h.png" class="block-footer__logos__image block-footer__logos__image--normal h-my--15 h-px--md--10 h-mb--md--10" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/06/chomar-2-143h.png 448w, https://vblocalhost.com/uploads/2021/06/chomar-2-143h-300x96.png 300w" sizes="(max-width: 448px) 100vw, 448px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.cyberthreatalliance.org/" target="_blank" rel="noopener">
                                        <img width="499" height="195" src="https://vblocalhost.com/uploads/2021/04/TIPS-sponsor-CTA.png" class="block-footer__logos__image block-footer__logos__image--normal h-my--15 h-px--md--10 h-mb--md--10" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/04/TIPS-sponsor-CTA.png 499w, https://vblocalhost.com/uploads/2021/04/TIPS-sponsor-CTA-300x117.png 300w" sizes="(max-width: 499px) 100vw, 499px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.malwarebytes.com/" target="_blank" rel="noopener">
                                        <img width="549" height="143" src="https://vblocalhost.com/uploads/2021/06/Malwarebytes-new2-143h.png" class="block-footer__logos__image block-footer__logos__image--normal h-my--15 h-px--md--10 h-mb--md--10" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/06/Malwarebytes-new2-143h.png 549w, https://vblocalhost.com/uploads/2021/06/Malwarebytes-new2-143h-300x78.png 300w" sizes="(max-width: 549px) 100vw, 549px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="http://reasonlabs.com/" target="_blank" rel="noopener">
                                        <img width="660" height="143" src="https://vblocalhost.com/uploads/reason-colour-143h.png" class="block-footer__logos__image block-footer__logos__image--normal h-my--15 h-px--md--10 h-mb--md--10" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/reason-colour-143h.png 660w, https://vblocalhost.com/uploads/reason-colour-143h-300x65.png 300w" sizes="(max-width: 660px) 100vw, 660px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://blog.talosintelligence.com/" target="_blank" rel="noopener">
                                        <img width="337" height="143" src="https://vblocalhost.com/uploads/Talos-143h-5.png" class="block-footer__logos__image block-footer__logos__image--normal h-my--15 h-px--md--10 h-mb--md--10" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/Talos-143h-5.png 337w, https://vblocalhost.com/uploads/Talos-143h-5-300x127.png 300w" sizes="(max-width: 337px) 100vw, 337px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.totalav.com/" target="_blank" rel="noopener">
                                        <img width="497" height="143" src="https://vblocalhost.com/uploads/2021/07/Total-AV-3-143.png" class="block-footer__logos__image block-footer__logos__image--normal h-my--15 h-px--md--10 h-mb--md--10" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/07/Total-AV-3-143.png 497w, https://vblocalhost.com/uploads/2021/07/Total-AV-3-143-300x86.png 300w" sizes="(max-width: 497px) 100vw, 497px" />                                    </a>
                                                                                    </div>
                    
                </div>

            
        </div>

        
</div>

					
				
				
					
						<div class="block-footer__logos">

    
        <div class="">

            
                <div class="block-logos__inner block-logos__inner--infinite  d-flex flex-row align-items-center">

                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.adaptivemobile.com/" target="_blank" rel="noopener">
                                        <img width="753" height="143" src="https://vblocalhost.com/uploads/2021/09/3-adaptivemobile-143h.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/09/3-adaptivemobile-143h.png 753w, https://vblocalhost.com/uploads/2021/09/3-adaptivemobile-143h-300x57.png 300w" sizes="(max-width: 753px) 100vw, 753px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.amazon.jobs/en-gb/team/infosec" target="_blank" rel="noopener">
                                        <img width="423" height="143" src="https://vblocalhost.com/uploads/2021/05/amazon_logo-143h.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/05/amazon_logo-143h.png 423w, https://vblocalhost.com/uploads/2021/05/amazon_logo-143h-300x101.png 300w" sizes="(max-width: 423px) 100vw, 423px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://appesteem.com/" target="_blank" rel="noopener">
                                        <img width="481" height="143" src="https://vblocalhost.com/uploads/2021/09/appesteem-143h.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/09/appesteem-143h.png 481w, https://vblocalhost.com/uploads/2021/09/appesteem-143h-300x89.png 300w" sizes="(max-width: 481px) 100vw, 481px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://arcabit.pl" target="_blank" rel="noopener">
                                        <img width="543" height="143" src="https://vblocalhost.com/uploads/2021/09/2-arcabit-143.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/09/2-arcabit-143.png 543w, https://vblocalhost.com/uploads/2021/09/2-arcabit-143-300x79.png 300w" sizes="(max-width: 543px) 100vw, 543px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.av-comparatives.org/enterprise/" target="_blank" rel="noopener">
                                        <img width="473" height="143" src="https://vblocalhost.com/uploads/2021/05/AVC_143h.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/05/AVC_143h.png 473w, https://vblocalhost.com/uploads/2021/05/AVC_143h-300x91.png 300w" sizes="(max-width: 473px) 100vw, 473px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.combocleaner.com/" target="_blank" rel="noopener">
                                        <img width="563" height="143" src="https://vblocalhost.com/uploads/2021/09/2-combocleaner-143h.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/09/2-combocleaner-143h.png 563w, https://vblocalhost.com/uploads/2021/09/2-combocleaner-143h-300x76.png 300w" sizes="(max-width: 563px) 100vw, 563px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://research.checkpoint.com/" target="_blank" rel="noopener">
                                        <img width="249" height="143" src="https://vblocalhost.com/uploads/2021/08/checkpoint-143-3.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.farsightsecurity.com/" target="_blank" rel="noopener">
                                        <img width="429" height="143" src="https://vblocalhost.com/uploads/2021/05/Farsight-143h.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/05/Farsight-143h.png 429w, https://vblocalhost.com/uploads/2021/05/Farsight-143h-300x100.png 300w" sizes="(max-width: 429px) 100vw, 429px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.f5.com/" target="_blank" rel="noopener">
                                        <img width="146" height="143" src="https://vblocalhost.com/uploads/2021/05/F5-143.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.fortinet.com/" target="_blank" rel="noopener">
                                        <img width="532" height="143" src="https://vblocalhost.com/uploads/2021/09/2-Fortinet-143h.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/09/2-Fortinet-143h.png 532w, https://vblocalhost.com/uploads/2021/09/2-Fortinet-143h-300x81.png 300w" sizes="(max-width: 532px) 100vw, 532px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.hornetsecurity.com/us/services/365-total-protection/?LP=virusbulletin%20-%20lc-Eml-blast-emailinsert_VB2021con&Cat=LC&utm_source=virusbulletin&utm_medium=lc&utm_campaign=365-TP&utm_content=eblast" target="_blank" rel="noopener">
                                        <img width="284" height="143" src="https://vblocalhost.com/uploads/2021/08/hornetsecurity-143.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.qianxin.com/" target="_blank" rel="noopener">
                                        <img width="720" height="143" src="https://vblocalhost.com/uploads/2021/05/Qi-Anxin-143.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/05/Qi-Anxin-143.png 720w, https://vblocalhost.com/uploads/2021/05/Qi-Anxin-143-300x60.png 300w" sizes="(max-width: 720px) 100vw, 720px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://support.virustotal.com/hc/en-us/categories/360000160117-About-us" target="_blank" rel="noopener">
                                        <img width="545" height="143" src="https://vblocalhost.com/uploads/2021/06/2VirusTotal-143h.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/06/2VirusTotal-143h.png 545w, https://vblocalhost.com/uploads/2021/06/2VirusTotal-143h-300x79.png 300w" sizes="(max-width: 545px) 100vw, 545px" />                                    </a>
                                                                                    </div>
                                            <div class="block-logos__logo-wrapper h-px--15 h-px--md--0">
                                                                                                <a href="https://www.zscaler.com/" target="_blank" rel="noopener">
                                        <img width="576" height="143" src="https://vblocalhost.com/uploads/2021/06/Zscaler-143h-2.png" class="block-footer__logos__image h-my--15 h-px--md--10 h-mb--md--10 h-p--md--0" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/06/Zscaler-143h-2.png 576w, https://vblocalhost.com/uploads/2021/06/Zscaler-143h-2-300x74.png 300w" sizes="(max-width: 576px) 100vw, 576px" />                                    </a>
                                                                                    </div>
                    
                </div>

            
        </div>

    
</div>

					
				
			</div>

			<div class="block-footer__bottom d-flex align-items-start justify-content-center h-py--15 flex-wrap">
				
					
													<span class="h-fs--14 h-pt--md--20 h-color--graphite-black block-footer__bottom__copyright-text h-mb--20">© 1989-2021 Virus Bulletin Ltd</span>
						
						<div class="block-footer__bottom__useful-links d-flex flex-wrap justify-content-center">
							
								
									<a class="block-footer__bottom__link h-px--10 h-mb--10 h-pl--md--0 h-pr--md--10 h-fs--14 h-color--graphite-black h-pb--md--5" href="/privacy-policy/">Privacy Policy</a>

								
									<a class="block-footer__bottom__link h-px--10 h-mb--10 h-pl--md--0 h-pr--md--10 h-fs--14 h-color--graphite-black h-pb--md--5" href="/code-of-conduct/">Code of Conduct</a>

								
									<a class="block-footer__bottom__link h-px--10 h-mb--10 h-pl--md--0 h-pr--md--10 h-fs--14 h-color--graphite-black h-pb--md--5" href="/cookie-policy/">Cookie Policy</a>

								
									<a class="block-footer__bottom__link h-px--10 h-mb--10 h-pl--md--0 h-pr--md--10 h-fs--14 h-color--graphite-black h-pb--md--5" href="/terms-of-use/">Terms and Conditions</a>

								
									<a class="block-footer__bottom__link h-px--10 h-mb--10 h-pl--md--0 h-pr--md--10 h-fs--14 h-color--graphite-black h-pb--md--5" href="https://www.virusbulletin.com/conference/vb-conference-archive/">Conference Archives</a>

								
									<a class="block-footer__bottom__link h-px--10 h-mb--10 h-pl--md--0 h-pr--md--10 h-fs--14 h-color--graphite-black h-pb--md--5" href="https://www.virusbulletin.com/testing/">VB Certification Services</a>

								
													</div>

					
				
			</div>
			</div>
		</div>
	</div>
</div>
<div class="teaser">
	<div class="block-footer teaser h-bgcolor--secondary">
		<div class="container">
				<div class="block-footer__blocks-wrapper d-flex justify-content-between h-py--50  h-pb--md--0 h-mb--md--25">
										

					<div class="block-footer__general-information">
	<div class="block-footer__img-holder d-flex justify-content-between align-items-center">
		<img src="https://vblocalhost.com/wp-content/themes/frontend/assets/images/logo.svg" class="block-footer__general-information__logo footer-conference-logo" alt="Shades of Red: RedXOR Linux backdoor and its Chinese origins">

		<img width="1820" height="600" src="https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed.png" class="block-footer__general-information__logo" alt="" loading="lazy" srcset="https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed.png 1820w, https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed-300x99.png 300w, https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed-1024x338.png 1024w, https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed-768x253.png 768w, https://vblocalhost.com/uploads/2021/05/vb2021-localhost-reversed-1536x506.png 1536w" sizes="(max-width: 1820px) 100vw, 1820px" />
					<div class="block-footer__general-information__footer-description h-color--graphite-black">
				<p><a href="https://twitter.com/hashtag/vblocalhost" target="_blank" rel="noopener">#vblocalhost</a></p>
			</div>

		
		
		
	</div>

</div>

												
																			
				
					<div class="block-social-icons">

  <div class="container">

    <div class="d-flex flex-wrap">

      
      
        
          
            <a href="https://twitter.com/virusbtn" class="d-flex justify-content-center align-items-center block-social-icons__item block-social-icons__item--rounded block-social-icons__item--small" target="_blank" rel="noopener"><i class="block-social-icons__item__logo h-color--white fa fa-twitter text-center"></i></a>

          
        
          
            <a href="https://www.linkedin.com/company/virus-bulletin" class="d-flex justify-content-center align-items-center block-social-icons__item block-social-icons__item--rounded block-social-icons__item--small" target="_blank" rel="noopener"><i class="block-social-icons__item__logo h-color--white fa fa-linkedin text-center"></i></a>

          
        
          
            <a href="https://www.facebook.com/virusbulletin" class="d-flex justify-content-center align-items-center block-social-icons__item block-social-icons__item--rounded block-social-icons__item--small" target="_blank" rel="noopener"><i class="block-social-icons__item__logo h-color--white fa fa-facebook-f text-center"></i></a>

          
        
          
            <a href="https://www.youtube.com/user/virusbtn" class="d-flex justify-content-center align-items-center block-social-icons__item block-social-icons__item--rounded block-social-icons__item--small" target="_blank" rel="noopener"><i class="block-social-icons__item__logo h-color--white fa fa-youtube-play text-center"></i></a>

          
        
      
    </div>

  </div>
</div>

									</div>
		
		<div class="block-footer__bottom d-flex align-items-start justify-content-between h-py--40">
			
				
											<span class="h-fs--14 h-pt--md--20 h-color--white block-footer__bottom__copyright-text">© 1989-2021 Virus Bulletin Ltd</span>
					
					<div class="block-footer__bottom__useful-links d-flex flex-wrap justify-content-start">
						
							
								<a class="block-footer__bottom__link h-px--5 h-mb--lg--5 h-pl--md--0 h-pr--md--10 h-fs--12 h-color--white h-pb--md--5" href="/privacy-policy/">Privacy Policy</a>

							
								<a class="block-footer__bottom__link h-px--5 h-mb--lg--5 h-pl--md--0 h-pr--md--10 h-fs--12 h-color--white h-pb--md--5" href="/code-of-conduct/">Code of Conduct</a>

							
								<a class="block-footer__bottom__link h-px--5 h-mb--lg--5 h-pl--md--0 h-pr--md--10 h-fs--12 h-color--white h-pb--md--5" href="/cookie-policy/">Cookie Policy</a>

							
								<a class="block-footer__bottom__link h-px--5 h-mb--lg--5 h-pl--md--0 h-pr--md--10 h-fs--12 h-color--white h-pb--md--5" href="/terms-of-use/">Terms and Conditions</a>

							
								<a class="block-footer__bottom__link h-px--5 h-mb--lg--5 h-pl--md--0 h-pr--md--10 h-fs--12 h-color--white h-pb--md--5" href="https://www.virusbulletin.com/conference/vb-conference-archive/">Conference Archives</a>

							
								<a class="block-footer__bottom__link h-px--5 h-mb--lg--5 h-pl--md--0 h-pr--md--10 h-fs--12 h-color--white h-pb--md--5" href="https://www.virusbulletin.com/testing/">VB Certification Services</a>

							
											</div>

				
			
		</div>
		</div>


		<a href="#top" class="block-footer__scroll-top">
			<img src="https://vblocalhost.com/wp-content/themes/frontend/assets/icons/icon-arrow-up.svg" alt="home arrow">
		</a>
	</div>
</div>

</footer>


<div class="block-cookie-popup">

	</div>
	
<script>
	jQuery(function ($) {
	$(document).ready(() => {
		if(document.cookie.includes('cookie_policy_viewed=yes')) {
			return;
		}

		let link = 'https://vblocalhost.com/cookie-policy/';

		if (window.location.href.includes('conference')) {
			const prepend = 'https://';
			const prependRemoved = link.replace(`${prepend}`, '');
			const slugStart = prependRemoved.indexOf('/') + prepend.length;

			link = [
				link.slice(0, slugStart),
				'/conference',
				link.slice(slugStart),
			].join('');
		}

		const CC = window.CookieConsent;

		const cc = new CC({
			content: {
				header: 'Our site uses cookies',
				message: 'We use cookies to give you the best possible experience on our website. By continuing to browse this site, you give consent for cookies to be used. For more details, please read our',
				dismiss: 'Got It',
				allow: '',
				deny: '',
				link: 'Cookie Policy',
				href: link,
				close: '&#x274c;',
				policy: 'Cookie Policy',
				target: '_blank',
			},
			type: 'a',
			layout: 'basic-header',
			position: 'bottom-left',
			palette: {
				popup: {
					background: '#eee',
					text: '#000',
				},
				button: {
					background: 'transparent',
					text: '#000',
					border: '#000',
				},
			},
		});

		const currentDate = new Date();
		currentDate.setFullYear(currentDate.getFullYear() + 1);
		cc.on( "statusChanged", ( args ) => {
			document.cookie = `cookie_policy_viewed=yes; path=/; expires=${currentDate}`;
		});

	});
});

</script>
</body>
</html>




